Hacking: The Next Generation

Hacking: The Next Generation

Hacking: The Next Generation

Nitesh Dhanjani, Billy Rios, and Brett Hardin

Beijing • Cambridge • Farnham • Köln • Sebastopol • Taipei • Tokyo

Hacking: The Next Generation by Nitesh Dhanjani, Billy Rios, and Brett Hardin Copyright © 2009 Nitesh Dhanjani. All rights reserved. Printed in the United States of America. Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://my.safaribooksonline.com). For more information, contact our corporate/institutional sales department: (800) 998-9938 or [email protected].

Editor: Mike Loukides Production Editor: Loranah Dimant Copyeditor: Audrey Doyle Proofreader: Sada Preisch

Indexer: Seth Maislin Cover Designer: Karen Montgomery Interior Designer: David Futato Illustrator: Robert Romano

Printing History: September 2009:

First Edition.

Nutshell Handbook, the Nutshell Handbook logo, and the O’Reilly logo are registered trademarks of O’Reilly Media, Inc. Hacking: The Next Generation, the image of a pirate ship on the cover, and related trade dress are trademarks of O’Reilly Media, Inc. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O’Reilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix 1. Intelligence Gathering: Peering Through the Windows to Your Organization . . . . . . 1 Physical Security Engineering Dumpster Diving Hanging Out at the Corporate Campus Google Earth Social Engineering Call Centers Search Engine Hacking Google Hacking Automating Google Hacking Extracting Metadata from Online Documents Searching for Source Code Leveraging Social Networks Facebook and MySpace Twitter Tracking Employees Email Harvesting with theHarvester Resumés Job Postings Google Calendar What Information Is Important? Summary

1 2 3 5 6 7 7 8 9 11 12 13 15 16 16 18 19 21 22 23

2. Inside-Out Attacks: The Attacker Is the Insider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Man on the Inside Cross-Site Scripting (XSS) Stealing Sessions Injecting Content Stealing Usernames and Passwords Advanced and Automated Attacks

26 26 27 28 30 34

v

Cross-Site Request Forgery (CSRF) Inside-Out Attacks Content Ownership Abusing Flash’s crossdomain.xml Abusing Java Advanced Content Ownership Using GIFARs Stealing Documents from Online Document Stores Stealing Files from the Filesystem Safari File Stealing Summary

37 38 48 49 51 54 55 63 63 69

3. The Way It Works: There Is No Patch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Exploiting Telnet and FTP Sniffing Credentials Brute-Forcing Your Way In Hijacking Sessions Abusing SMTP Snooping Emails Spoofing Emails to Perform Social Engineering Abusing ARP Poisoning the Network Cain & Abel Sniffing SSH on a Switched Network Leveraging DNS for Remote Reconnaissance DNS Cache Snooping Summary

72 72 74 75 77 77 78 80 81 81 82 84 85 88

4. Blended Threats: When Applications Exploit Each Other . . . . . . . . . . . . . . . . . . . . . . 91 Application Protocol Handlers Finding Protocol Handlers on Windows Finding Protocol Handlers on Mac OS X Finding Protocol Handlers on Linux Blended Attacks The Classic Blended Attack: Safari’s Carpet Bomb The FireFoxUrl Application Protocol Handler Mailto:// and the Vulnerability in the ShellExecute Windows API The iPhoto Format String Exploit Blended Worms: Conficker/Downadup Finding Blended Threats Summary

93 96 99 101 102 103 108 111 114 115 118 119

5. Cloud Insecurity: Sharing the Cloud with Your Enemy . . . . . . . . . . . . . . . . . . . . . . . 121 What Changes in the Cloud vi | Table of Contents

121

Amazon’s Elastic Compute Cloud Google’s App Engine Other Cloud Offerings Attacks Against the Cloud Poisoned Virtual Machines Attacks Against Management Consoles Secure by Default Abusing Cloud Billing Models and Cloud Phishing Googling for Gold in the Cloud Summary

122 122 123 123 124 126 140 141 144 146

6. Abusing Mobile Devices: Targeting Your Mobile Workforce . . . . . . . . . . . . . . . . . . . 149 Targeting Your Mobile Workforce Your Employees Are on My Network Getting on the Network Direct Attacks Against Your Employees and Associates Putting It Together: Attacks Against a Hotspot User Tapping into Voicemail Exploiting Physical Access to Mobile Devices Summary

150 150 152 162 166 171 174 175

7. Infiltrating the Phishing Underground: Learning from Online Criminals? . . . . . . . 177 The Fresh Phish Is in the Tank Examining the Phishers No Time to Patch Thank You for Signing My Guestbook Say Hello to Pedro! Isn’t It Ironic? The Loot Uncovering the Phishing Kits Phisher-on-Phisher Crime Infiltrating the Underground Google ReZulT Fullz for Sale! Meet Cha0 Summary

178 179 179 182 184 189 190 191 193 195 196 197 198 200

8. Influencing Your Victims: Do What We Tell You, Please . . . . . . . . . . . . . . . . . . . . . . 201 The Calendar Is a Gold Mine Information in Calendars Who Just Joined? Calendar Personalities Social Identities

201 202 203 204 206 Table of Contents | vii

Abusing Social Profiles Stealing Social Identities Breaking Authentication Hacking the Psyche Summary

207 210 212 217 220

9. Hacking Executives: Can Your CEO Spot a Targeted Attack? . . . . . . . . . . . . . . . . . . . 223 Fully Targeted Attacks Versus Opportunistic Attacks Motives Financial Gain Vengeance Benefit and Risk Information Gathering Identifying Executives The Trusted Circle Twitter Other Social Applications Attack Scenarios Email Attack Targeting the Assistant Memory Sticks Summary

223 224 224 225 226 226 226 227 230 232 232 233 238 239 240

10. Case Studies: Different Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241 The Disgruntled Employee The Performance Review Spoofing into Conference Calls The Win The Silver Bullet The Free Lunch The SSH Server Turning the Network Inside Out A Fool with a Tool Is Still a Fool Summary

241 241 243 245 245 246 247 249 252 253

A. Chapter 2 Source Code Samples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255 B. Cache_Snoop.pl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

viii | Table of Contents

Preface

Attack vectors that seemed fantastical in the past are now a reality. The reasons for this are twofold. First, the need for mobility and agility in technology has made the traditional perimeter-based defense model invalid and ineffective. The consumption of services in the cloud, the use of wireless access points and mobile devices, and the access granted to contingent workers have made the concept of the perimeter irrelevant and meaningless. This issue is further amplified by the increased complexity of and trust placed on web browsers, which when successfully exploited can turn the perimeter inside out. Second, the emergence of Generation Y culture in the workforce is facilitating the use of social media and communication platforms to the point where citizens are sharing critical data about themselves that has been nearly impossible to capture remotely in the past. The new generation of attackers is aware of risks in emerging technologies and knows how to exploit the latest platforms to the fullest extent. This book will expose the skill set and mindset that today’s sophisticated attackers employ to abuse technology and people so that you can learn how to protect yourself from them.

Audience This book is for anyone interested in learning the techniques that the more sophisticated attackers are using today. Other books on the topic have the habit of rehashing legacy attack and penetration methodologies that are no longer of any use to criminals. If you want to learn how the techniques criminals use today have evolved to contain crafty tools and procedures that can compromise a targeted individual or an enterprise, this book is for you.

Assumptions This Book Makes This book assumes you are familiar with and can graduate beyond elementary attack and penetration techniques, such as the use of port scanners and network analyzers. A basic understanding of common web application flaws will be an added plus.

ix

Contents of This Book This book is divided into 10 chapters. Here’s a summary of what we cover: Chapter 1, Intelligence Gathering: Peering Through the Windows to Your Organization To successfully execute an attack against any given organization, the attacker must first perform reconnaissance to gather as much intelligence about the organization as possible. In this chapter, we look at traditional attack methods as well as how the new generation of attackers is able to leverage new technologies for information gathering. Chapter 2, Inside-Out Attacks: The Attacker Is the Insider Not only does the popular perimeter-based approach to security provide little risk reduction today, but it is in fact contributing to an increased attack surface that criminals are using to launch potentially devastating attacks. The impact of the attacks illustrated in this chapter can be extremely devastating to businesses that approach security with a perimeter mindset where the insiders are generally trusted with information that is confidential and critical to the organization. Chapter 3, The Way It Works: There Is No Patch The protocols that support network communication, which are relied upon for the Internet to work, were not specifically designed with security in mind. In this chapter, we study why these protocols are weak and how attackers have and will continue to exploit them. Chapter 4, Blended Threats: When Applications Exploit Each Other The amount of software installed on a modern computer system is staggering. With so many different software packages on a single machine, the complexity of managing the interactions between these software packages becomes increasingly complex. Complexity is the friend of the next-generation hacker. This chapter exposes the techniques used to pit software against software. We present the various blended threats and blended attacks so that you can gain some insight as to how these attacks are executed and the thought process behind blended exploitation. Chapter 5, Cloud Insecurity: Sharing the Cloud with Your Enemy Cloud computing is seen as the next generation of computing. The benefits, cost savings, and business justifications for moving to a cloud-based environment are compelling. This chapter illustrates how next-generation hackers are positioning themselves to take advantage of and abuse cloud platforms, and includes tangible examples of vulnerabilities we have discovered in today’s popular cloud platforms. Chapter 6, Abusing Mobile Devices: Targeting Your Mobile Workforce Today’s workforce is a mobile army, traveling to the customer and making business happen. The explosion of laptops, wireless networks, and powerful cell phones, coupled with the need to “get things done,” creates a perfect storm for the nextgeneration attacker. This chapter walks through some scenarios showing how the mobile workforce can be a prime target of attacks.

x | Preface

Chapter 7, Infiltrating the Phishing Underground: Learning from Online Criminals? Phishers are a unique bunch. They are a nuisance to businesses and legal authorities and can cause a significant amount of damage to a person’s financial reputation. In this chapter, we infiltrate and uncover this ecosystem so that we can shed some light on and advance our quest toward understanding this popular subset of the new generation of criminals. Chapter 8, Influencing Your Victims: Do What We Tell You, Please The new generation of attackers doesn’t want to target only networks, operating systems, and applications. These attackers also want to target the people who have access to the data they want to get a hold of. It is sometimes easier for an attacker to get what she wants by influencing and manipulating a human being than it is to invest a lot of time finding and exploiting a technical vulnerability. In this chapter, we look at the crafty techniques attackers employ to discover information about people to influence them. Chapter 9, Hacking Executives: Can Your CEO Spot a Targeted Attack? When attackers begin to focus their attacks on specific corporate individuals, executives often become the prime target. These are the “C Team” members of the company—for instance, chief executive officers, chief financial officers, and chief operating officers. Not only are these executives in higher income brackets than other potential targets, but also the value of the information on their laptops can rival the value of information in the corporation’s databases. This chapter walks through scenarios an attacker may use to target executives of large corporations. Chapter 10, Case Studies: Different Perspectives This chapter presents two scenarios on how a determined hacker can crosspollinate vulnerabilities from different processes, systems, and applications to compromise businesses and steal confidential data. In addition to these 10 chapters, the book also includes two appendixes. Appendix A provides the source code samples from Chapter 2, and Appendix B provides the complete Cache_snoop.pl script, which is designed to aid in exploiting DNS servers that are susceptible to DNS cache snooping.

Conventions Used in This Book The following typographical conventions are used in this book: Italic Indicates new terms, URLs, email addresses, filenames, file extensions, pathnames, directories, and Unix utilities Constant width

Indicates commands, options, switches, variables, attributes, keys, functions, types, classes, namespaces, methods, modules, properties, parameters, values, objects, events, event handlers, XML tags, HTML tags, macros, the contents of files, and the output from commands Preface | xi

Constant width bold

Shows commands and other text that should be typed literally by the user Constant width italic

Shows text that should be replaced with user-supplied values This icon signifies a tip, suggestion, or general note.

This icon indicates a warning or caution.

Using Code Examples This book is here to help you get your job done. In general, you may use the code in this book in your own configurations and documentation. You do not need to contact us for permission unless you’re reproducing a significant portion of the material. For example, writing a program that uses several chunks of code from this book does not require permission. Selling or distributing a CD-ROM of examples from this book does require permission. We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN. For example: “Hacking: The Next Generation, by Nitesh Dhanjani, Billy Rios, and Brett Hardin. Copyright 2009, Nitesh Dhanjani, 978-0-596-15457-8.” If you feel your use of code examples falls outside fair use or the permission given here, feel free to contact us at [email protected].

We’d Like to Hear from You Please address comments and questions concerning this book to the publisher: O’Reilly Media, Inc. 1005 Gravenstein Highway North Sebastopol, CA 95472 800-998-9938 (in the United States or Canada) 707-829-0515 (international or local) 707-829-0104 (fax) We have a web page for this book, where we list errata, examples, and any additional information. You can access this page at: http://www.oreilly.com/catalog/9780596154578 xii | Preface

To comment or ask technical questions about this book, send email to: [email protected] For more information about our books, conferences, Resource Centers, and the O’Reilly Network, see our website at: http://www.oreilly.com

Safari® Books Online Safari Books Online is an on-demand digital library that lets you easily search over 7,500 technology and creative reference books and videos to find the answers you need quickly. With a subscription, you can read any page and watch any video from our library online. Read books on your cell phone and mobile devices. Access new titles before they are available for print, and get exclusive access to manuscripts in development and post feedback for the authors. Copy and paste code samples, organize your favorites, download chapters, bookmark key sections, create notes, print out pages, and benefit from tons of other time-saving features. O’Reilly Media has uploaded this book to the Safari Books Online service. To have full digital access to this book and others on similar topics from O’Reilly and other publishers, sign up for free at http://my.safaribooksonline.com.

Acknowledgments Thanks to Mike Loukides for accepting the book proposal and for his guidance throughout the writing process. A big thank you goes to the design team at O’Reilly for creating such a fantastic book cover. Thanks also to the rest of the O’Reilly team— Laurel Ackerman, Maria Amodio, Karen Crosby, Audrey Doyle, Edie Freedman, Jacque McIlvaine, Rachel Monaghan, Karen Montgomery, Marlowe Shaeffer, and Karen Shaner. Also, thanks to Mark Lucking for reviewing our chapters. Nitesh would like to thank Richard Dawkins for his dedication in promoting the public understanding of science. At a time when reason increasingly seems unfashionable, Richard’s rhetoric provided comfort and hope that were instrumental in gathering up the energy and enthusiasm needed to write this book (and for other things). Billy would like to thank his family for their encouragement, his wife for her unending support, and his daughter for her smiles. Brett would like to thank his wife for allowing him many long days and nights away from his family.

Preface | xiii

CHAPTER 1

Intelligence Gathering: Peering Through the Windows to Your Organization

To successfully execute an attack against an organization, the attacker must first perform reconnaissance to gather as much intelligence about the organization as possible. Many traditional methods for gaining intelligence about targets still work today, such as dumpster diving, querying public databases, and querying search engines. However, new methods that rely on gathering information from technologies such as social networking applications are becoming more commonplace. In this chapter, we will discuss the traditional methods as well as how the new generation of attackers is able to abuse new technologies to gather information. From the attacker’s point of view, it is extremely important to perform reconnaissance as surreptitiously as possible. Since information gathering is one of the first steps the attacker may perform, he must take care not to do anything that may alert the target. The techniques in this chapter will therefore concentrate on methods that allow an attacker to gather information without sending a single network packet toward the target. Information gathered during reconnaissance always ends up aiding the attacker in some way, even if it isn’t clear early on how the information is useful. Attackers want to obtain as much information about their target as possible, knowing that the data they collect, if not immediately useful, will most likely be useful in later stages of the attack.

Physical Security Engineering Gathering information through physical means is a traditional tactic that attackers have been using for a while now. Some examples of information that an attacker can obtain from these methods include network diagrams, financial information, floor plans,

1

phone lists, and information regarding conflicts and communications among employees. In the next section, we will look at the different techniques attackers use to gather intelligence by physical means.

Dumpster Diving Dumpster diving, also called “trashing,” is a method of information gathering in which an attacker searches through on-site trash cans and dumpsters to gather information about the target organization. This technique is not new, yet attackers are still able to use it to gather substantial amounts of intelligence. Methods have been developed to attempt to prevent attackers from dumpster diving, such as shredding sensitive data and using off-site companies to securely dispose of sensitive documents. Even though some companies have taken preventive measures to prevent dumpster diving, attackers can still gather information if they are willing to go through a target’s trash. Instead of securely disposing of trash, employees often throw away information that is considered sensitive into the nearest trash can. Humans are creatures of habit and convenience. Why would a person want to walk 25 feet to dispose of something when there is a trash can under her desk? Figure 1-1 shows a printer cover sheet that exposes the username of the person who requested the print job. Even this username on a piece of paper is an important find for an attacker because it helps the attacker understand how the corporation handles usernames (the first letter of the user’s first name, capitalized, appended to the user’s last name, initial-capped). This knowledge gives the attacker an understanding of how to formulate an individual’s corporate username. The attacker can then use this to conduct further attacks, such as brute force password cracking.

Figure 1-1. Printer banner exposing a username

2 | Chapter 1: Intelligence Gathering: Peering Through the Windows to Your Organization

On-site dumpsters are typically easy for attackers to access and often have no locks to secure their contents. Even if locks do exist, attackers can easily bypass them to expose the dumpsters’ contents. More and more attackers are learning ways to bypass locks. Information security conferences often conduct lock-picking contests in which contestants are judged based on the speed with which they can pick a lock or the variety of locks they can bypass. Figure 1-2 shows a photo of the electronic timing system used to test contestants’ speed in bypassing a lock at the DEFCON 12 hacker convention. Even locks don’t prevent attackers from going through the contents of a dumpster.

Figure 1-2. Electronic timing system at DEFCON 12’s lock-picking contest (picture provided by Deviant Ollam)

As long as attackers can obtain useful information from trash cans and dumpsters, dumpster diving will continue to be an avenue for information gathering.

Hanging Out at the Corporate Campus Attackers often go on-site, to the corporate location, to gain more information about their targets. Attackers have determined they can gain intricate knowledge about an organization just by walking around the corporate campus and overhearing work conversations. Employees are often oblivious to the fact that some people walking around corporate campuses aren’t company employees. Attackers can overhear conversations regarding confidential topics such as IPOs, products in development, and impending layoffs. This information can become useful in social engineering attacks involving phone calls and emails, which we will address in later chapters. For now, here is a sample conversation that is typical of what an attacker may overhear at a corporate campus, involving two employees walking to their cars: Physical Security Engineering | 3

Sam: …but that’s why the Rams won the game. Bob: Yeah, but it was a close game. Sam: The seats were unbelievable. I wish you and Sally could’ve come. Bob: Yeah, me too; too many conference calls last night with the investment bank. Sam: I forgot about that. How is the IPO work going anyway? Bob: Pretty good. We have obtained underwriting from Large Investment Bank XYZ Corporation. The share price is currently being set at around 15. The bank thinks that is around 70% of what the stock will go for on the open market. Sam: Well, that should be a nice little investment for them. Bob: Yeah. Well, our shares should be worth more after the 180-day waiting period too. Sam: All right! That’s what I like to hear.

The information that is exposed in this conversation may not seem super-sensitive. But this information may aid an attacker in gaining an employee’s trust, since he knows about the IPO work that is being done. This information may even help someone who is not an attacker. It may help a non-critical employee or some other person who was walking around the corporate campus that day. Cigarette smokers are easy targets for gathering information about an organization. Typically, smokers have designated areas for their breaks; attackers can hang out in these areas, asking for “a light” and beginning a conversation with an employee about internal projects or intellectual property. The following is a conversation involving a person who appears to be an employee walking back to the building from lunch. The person stops and lights a cigarette and begins a conversation with a director at the company. Employee: How’s it going? Director: Good. (Reading a newspaper) Employee: Good to hear. (Waits patiently) *After a few seconds* Director: You know, every time I read one of these electronics ads, I want to go to the store and buy something. But once I get there I realize why I don’t go there. They have horrible customer service. Employee: I totally agree. What are you interested in purchasing? Director: Well, I was thinking about the.... *General small talk regarding television sets* Employee: Yeah, I would get the LCD television. So, when is the Q4 earnings call? I don’t think I received an email with the date yet. Director: January 25. But it’s a year-end call. As you know, here at Large Organization we have year-end calls instead of Q4 calls.

4 | Chapter 1: Intelligence Gathering: Peering Through the Windows to Your Organization

Employee: How are we handling ourselves with the way the economy is going right now? Director: Well, I can’t comment. It would be considered insider information. I wouldn’t want you to suffer from insider trading. Employee: Yeah, I understand. You can’t be too careful nowadays. Director: Nothing to be concerned about. (She walks toward the door.) Employee: I just want to know if I will have a job next year at this time. Ha! Director: Don’t worry about that. We did better this year than last year, even with the slumping economy. Have a good day. Employee: Have a good one.

Even though the director stated she couldn’t give out “insider” information, she still did. She stated, “We did better this year than last year.” This is exactly the type of information the attacker is looking for. In addition to overhearing or engaging in conversations on corporate campuses, attackers will attempt to follow employees into buildings. This is referred to as “piggybacking” and can be quite successful. Once inside a building, the attacker may attempt to check for unlocked doors that may provide additional areas to access or may expose the attacker to more corporate information. While attempting a physical penetration test for a client, we, the authors of this book, were able to piggyback an employee into a building. Once inside the building, we began to open doors to see which additional areas we might be able to access. We discovered an unlocked room in which employee badges were created. We created badges for ourselves (the computer’s password was the name of the company) and we no longer needed to piggyback employees into the building.

Google Earth Google Earth is free mapping software provided by Google. An attacker can use Google Earth to view a map of his target’s physical location before arriving on-site, providing him with spatial knowledge of the target environment. The attacker will have an easier time blending in with other employees if he already knows the general path other employees take. Figure 1-3 shows O’Reilly’s corporate campus from Google Earth. In addition to the spatial knowledge of a target, Google Earth also provides an easy way for attackers to plan entrance and escape routes. Attacks involving conflict, such as those involving the police, can easily be premeditated using Google Earth. The time it will take response teams, such as fire, medical, and law enforcement, to arrive can be calculated using this application.

Google Earth | 5

Figure 1-3. O’Reilly campus as seen from Google Earth

Social Engineering Call Centers Social engineering is the art of obtaining information from people who don’t want to give it. Journalists, law enforcement officers, and lawyers learn these skills as a trade. They learn techniques to intimidate or sympathize with a person so that the person “reveals her hand.” Attackers use similar techniques to gather sensitive information from unsuspecting victims. Call centers are a target for social engineering because they offer a great way to directly interact with employees from a given company. The company call center provides an attacker with a large population of targets. If these targets become hostile or become aware of the attacker, the attacker just needs to hang up and try again. Attackers often seek targets who are new to the organization, are easily intimidated, or don’t like dealing with confrontation. Call centers allow the attacker to leave a small footprint, meaning there is little chance the organization will even know that it is being attacked. A sample conversation between an attacker posing as a consumer and a call center employee may go something like this: Employee: Thank you for calling Large Organization. Can I get your account number? Caller: Yeah, sure. I think it is 55560-5-2219, but I could be wrong. I haven’t called in before. Employee: That’s all right; give me a few minutes while I look up that account’s information. Caller: No problem. How is your day going? (Jovial tone) Employee: I can’t complain. It’s just been a little hectic around here with the merger and all.

6 | Chapter 1: Intelligence Gathering: Peering Through the Windows to Your Organization

Caller: I read about that. It’s with Company X, right? Employee: Yeah, a lot of us aren’t sure if there will be positions for us once the merger is complete. Caller: Sorry to hear that. Employee: I can’t find any information for the account number you gave me. Are you sure that is your account number? Caller (ruffle of papers): I will have to look around and see if I can find it. I will call back later. Employee: Okay. Thanks for calling Large Organization. Have a great day.

The information the attacker received could be considered sensitive in nature. The attacker obtained information suggesting that Company X may be laying off employees because of a merger. He also discovered that Company X might be laying off people specifically from the support department that he called. This information could be useful to a competing organization. An attacker could then call recently laid-off people, assuming the role of a hiring manager, to get more information about the target organization.

Search Engine Hacking Search engines, by definition, are used to find and locate information on the World Wide Web. In addition to using search engines to search for information, attackers have ways of using search engines to identify and locate vulnerabilities and confidential data. Using search engines to find vulnerabilities offers a way for attackers to probe a network without the target’s knowledge since the entire search request and response come from the search engine and not the target. The attacker doesn’t leave a footprint since he is not sending information to the target. Attackers also use a cached page to view the information, instead of accessing the site directly, which creates another layer of protection for them.

Google Hacking Numerous books and presentations discuss how to gather “sensitive” information from Google. Attackers can use Google to gather basic information such as contact lists, internal documents, and top-level organizational structures, as well as locate potential vulnerabilities in an organization’s web application. Attackers can use a specific type of search query, called a dork, to locate security issues or confidential data. Attackers can use dorks to obtain firewall logs and customer data, and to find ways to access an organization’s database.

Search Engine Hacking | 7

Figure 1-4. Execution of an SQL injection dork

Security professionals have developed public databases of dorks. Dork databases exist for several different search engines; the most common dork database is the Google Hacking Database. The Google Hacking Database (GHDB) is a great resource for finding dorks that can aid an attacker. The GHDB is located at http://johnny .ihackstuff.com/ghdb/.

Using a dork is relatively simple. An attacker locates a dork of interest, and then uses Google to search for the dork. The following code is a dork that attempts to identify web applications that are susceptible to an SQL injection vulnerability by searching for a MySQL error message that commonly signifies the existence of an SQL injection flaw: "Unable to jump to row" "on MySQL result index" "on line"

An attacker can limit the dork to a certain domain by adding the site: directive to the query string. For example, here is a Google query that is limited to the example.com domain: "Unable to jump to row" "on MySQL result index" "on line" site:example.com

Figure 1-4 illustrates the execution of the SQL injection dork. Notice that more than 900,000 results were returned!

Automating Google Hacking An attacker can use the Search Engine Assessment Tool (SEAT), developed by Midnight Research Labs, to automate Google hacking. SEAT uses search engines and search caches to search for vulnerabilities for a particular domain. SEAT supports multiple search engines, including Google, Yahoo!, and MSN. SEAT also has a variety of built-in dorks. The databases that SEAT uses (shown in Figure 1-5) were compiled from multiple sources, including the GHDB and Nikto.

8 | Chapter 1: Intelligence Gathering: Peering Through the Windows to Your Organization

An attacker can select multiple databases and search engines when using SEAT. Along with SEAT’s multithreading, these features aid the attacker greatly when he’s gathering information via search engine hacking. Figure 1-6 shows SEAT during the execution stage running 15 simultaneous queries. You can obtain the latest version of SEAT from http://midnightresearch .com/projects/search-engine-assessment-tool/.

Extracting Metadata from Online Documents Metadata is “data about other data.” A good example of metadata is the data that is often inserted into Microsoft Office documents such as Word. For instance, Microsoft Word inserts data such as usernames and folder paths of the author’s machine. Attackers can extract this metadata from documents that corporations have put online. Using search engines, attackers can use specific directives to limit their results to specific file types that are known to include metadata. For example, the Google directive filetype:doc will return only Microsoft Word files. The following is a query that returns only PowerPoint presentations that contain the phrase “Q4 Expenses”: filetype:ppt "Q4 Expenses"

Figure 1-5. SEAT’s different built-in vulnerability databases

Attackers query Google using such queries; then they download the documents that are returned and examine them, pulling out any metadata stored within them. Search Engine Hacking | 9

Metagoofil is an automated tool that queries Google to find documents that are known to contain metadata. Metagoofil will query Google using a specific domain, download the files that are returned, and then attempt to extract the contents. Here is a demonstration of Metagoofil being used against example.com: $ python metagoofil.py -d example.com -f all -l 3 -o example.html -t DL ************************************* *MetaGooFil Ver. 1.4a * *Coded by Christian Martorella * *Edge-Security Research * *[email protected] * ************************************* [+] [+] [+] [+]

[+] [+] [+]

[+] [+] [+]

[+] [+] [+]

[+] [+] [+] [+] [+] [+] [+] [+] [+] [+]

Command extract found, proceeding with leeching Searching in example.com for: pdf Total results in google: 5300 Limit: 3 [ 1/3 ] http://www.example.com/english/lic/gl_app1.pdf [ 2/3 ] http://www.example.com/english/lic/gl_app2.pdf [ 3/3 ] http://www.example.com/english/lic/gl_app3.pdf Searching in example.com for: doc Total results in google: 1500 Limit: 3 [ 1/3 ] http://www.example.com/english/lic/gl_app1.doc [ 2/3 ] http://www.example.com/english/lic/gl_app2.doc [ 3/3 ] http://www.example.com/english/lic/gl_app3.doc Searching in example.com for: xls Total results in google: 20 Limit: 3 [ 1/3 ] http://www.example.com/english/lic/gl_app1.xls [ 2/3 ] http://www.example.com/english/lic/gl_app2.xls [ 3/3 ] http://www.example.com/english/lic/gl_app3.xls Searching in example.com for: ppt Total results in google: 60 Limit: 3 [ 1/3 ] http://www.example.com/english/lic/gl_app1.ppt [ 2/3 ] http://www.example.com/english/lic/gl_app1.ppt [ 3/3 ] http://www.example.com/english/lic/gl_app1.ppt Searching in example.com for: sdw Total results in google: 0 Searching in example.com for: mdb Total results in google: 0 Searching in example.com for: sdc Total results in google: 0 Searching in example.com for: odp Total results in google: 0 Searching in example.com for: ods Total results in google: 0

Usernames found: ================ rmiyazaki tyamanda hlee akarnik

10 | Chapter 1: Intelligence Gathering: Peering Through the Windows to Your Organization

April Jacobs Rwood Amatsuda Dmaha Dock, Matt Paths found: ============ C:\WINNT\Profiles\Dmaha\ C:\TEMP\Dmaha\ C:\Program Files\Microsoft Office\Templates|Presentation Designs\example C:\WINNT\Profiles\Rwood [+] Process finished

Figure 1-6. SEAT using 15 threads, searching for vulnerabilities using multiple search engines

The publicly available Python script metagoofil.py aids in searching, gathering, and extracting metadata from documents. It is available from http://www.edge-security.com/metagoofil.php.

Searching for Source Code Developers will often post code on public forums when they discover a bug they cannot solve. Too often, these developers will post code without redacting it in any way. It is unsettling how often these forums display code that clearly belongs to a specific organization. Information such as the developer’s name, internal comments, code descriptions, and organizational ownership are among the items you can find in source code that is posted on public forums on the Internet.

Search Engine Hacking | 11

Using Google, it is trivial to find some of this code in a short period of time. Using search terms such as “here is the code” and “here is the exact code” will return many results. Here is a code snippet that we found using Google (the code has been redacted):